[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-arm] [Qemu-devel] [PATCH v3] ARM: ACPI: Fix use-after-free due
|
From: |
Peter Maydell |
|
Subject: |
Re: [Qemu-arm] [Qemu-devel] [PATCH v3] ARM: ACPI: Fix use-after-free due to memory realloc |
|
Date: |
Thu, 31 May 2018 14:42:47 +0100 |
On 30 May 2018 at 10:03, Auger Eric <address@hidden> wrote:
> Hi Shannon,
>
> On 05/30/2018 09:05 AM, Shannon Zhao wrote:
>> acpi_data_push uses g_array_set_size to resize the memory size. If there
>> is no enough contiguous memory, the address will be changed. So previous
>> pointer could not be used any more. It must update the pointer and use
>> the new one.
>>
>> Also, previous codes wrongly use le32 conversion of iort->node_offset
>> for subsequent computations that will result incorrect value if host is
>> not litlle endian. So use the non-converted one instead.
>>
>> Signed-off-by: Shannon Zhao <address@hidden>
> Reviewed-by: Eric Auger <address@hidden>
Applied to target-arm.next, thanks.
-- PMM